Inceptron — Inference Providers on Stav

Compliance posture

Jurisdiction

EEA · Sweden

Data residency

EEA

CLOUD Act / FISA 702

Not exposed

Stav sovereignty level

L0 — Under third-country jurisdiction

Sovereignty ladder · how the level was reached

L0Foreign jurisdictionIndicative

Inceptron AB (Swedish Aktiebolag, Lund, SE) comfortably clears L1 on the strength of its EEA-only data residency commitment, zero CLOUD Act exposure, and no third-country parent. L2 is blocked by the unverified ISO 27001 claim: the certification is self-reported in marketing copy with no independent registry entry or certificate number found, which prevents it from meeting the 'substantial' assurance threshold for l2.security_certified. L3 cannot be confirmed as fully met because the Bolagsverket shareholder register could not be read (CAPTCHA-blocked), leaving eu_owned and eu_controlled at partial based on strong but secondary evidence of all-European investor base and no group structure; if primary register data confirms EU majority equity and no third-country controlling holder, L3 would likely be met. L4 is unmet due to absence of any sovereign qualification.

One criterion from L1: Infrastructure in the Union.

Stav's own assessment against criterion registry 4.0 — indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung.

Verified 9/4/2026About the ladder →

Stav's assessment · serving-side

71/100

Conditional

Inceptron AB is a Swedish (Lund), EEA-incorporated inference operator with no US parent, and its privacy policy commits to processing Customer Content exclusively within the EU/EEA with zero-retention as the API default — a genuinely favorable sovereignty and retention posture for regulated EU workloads. The composite lands in conditional territory chiefly because two dimensions pull it down: legal exposure is only mid-tier since sub-processors for hosting/infrastructure are described generically rather than named, leaving the serving-chain's EEA-boundedness unverifiable, and security posture is weakened by self-reported (unregistered) ISO 27001 claims, no public status page, and no independently confirmed breach history. Contractual posture is workable but not turnkey — the DPA is available only on request rather than bundled by default, and SCC coverage is referenced but not independently sourced. Serving retention is the strongest dimension, with a documented zero-retention default and bounded (~30-day) telemetry logging when opted in. Given the sound residency and retention story offset by unverified sub-processor chain and unaudited security claims, Stav treats Inceptron as sovereign serving available for EU-regulated workloads, but recommends requesting the named sub-processor list and executed DPA before onboarding as a long-term production vendor.

Serving residency

Privacy policy states Customer Content and API payloads are processed exclusively within the EU/EEA with no transfer outside it, but the unnamed infrastructure sub-processors leave the EEA-boundary of the underlying compute chain unverifiable.

Certifications & legal documents

Terms of serviceView ↗

Privacy policyView ↗

Data processing agreement (DPA)not published

Sub-processor listnot published

Compiled by Stav from the provider's published documentation. Last verified 9/4/2026. Reflects what the provider states — not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.